Examkin

Soru

Zorluk: OrtaHybrid and Multi-Account Network Connectivity Design

A media company is designing a hybrid network architecture to connect 88 VPCs in the `us-east-1` Region to their on-premises datacenter. They have established an AWS Direct Connect (DX) connection with a Transit VIF terminated at a Direct Connect Gateway (DXGW), which is attached to a regional AWS Transit Gateway (TGW). To ensure high availability, the company has also deployed an AWS Site-to-Site VPN connection as a backup to the same TGW. They want to configure dynamic routing using BGP such that the DX link is always preferred for all active traffic, and the VPN link is only utilized if the DX connection fails.

Which configuration should the company implement to meet these requirements with minimal administrative overhead?

  1. A
    Configure BGP dynamic routing on both paths. To prefer the Direct Connect link, configure the on-premises router to prepend its Autonomous System (AS) path multiple times when advertising its routes to AWS over the Direct Connect connection.
  2. B
    Configure BGP dynamic routing on both paths. Create an AWS Route 53 Private Hosted Zone (PHZ) containing failover routing records pointing to the Direct Connect Gateway and the VPN connection, and associate this PHZ with all 88 VPCs.
  3. Configure BGP dynamic routing on both the Direct Connect connection and the Site-to-Site VPN, advertising identical prefixes from the datacenter. On the on-premises router, configure a higher BGP local preference for routes received via the Direct Connect connection compared to the VPN connection.Cevap
  4. D
    Configure BGP dynamic routing on the Direct Connect connection and static routing on the Site-to-Site VPN. In the Transit Gateway route table, configure a static route for the on-premises CIDR pointing to the VPN attachment with a higher administrative distance.

Cevap

Configure BGP dynamic routing on both the Direct Connect connection and the Site-to-Site VPN, advertising identical prefixes from the datacenter, and configure a higher BGP local preference on the on-premises router for routes received via the Direct Connect connection.
Configuring BGP dynamic routing on both paths ensures automatic failover and minimal administrative overhead. For traffic from AWS to the datacenter, AWS Transit Gateway naturally prefers Direct Connect Gateway attachments over VPN attachments when the same prefixes are propagated. For traffic from the datacenter to AWS, the on-premises router must be configured to prefer the Direct Connect path, which is achieved by setting a higher BGP local preference for routes received via Direct Connect.

Adım Adım Çözüm

1
Analyze AWS Transit Gateway path selection behavior for outbound traffic from AWS to the on-premises datacenter.
Identify that when identical prefixes are advertised over both Direct Connect Gateway and VPN, Transit Gateway automatically prefers the Direct Connect Gateway attachment over the VPN attachment.
This establishes the correct primary path for egress traffic from the VPCs without manual route table manipulation.
2
Analyze path selection behavior for return traffic from the on-premises datacenter to AWS.
Determine that the on-premises router must be configured to prefer the prefixes received via Direct Connect over those received via the VPN.
BGP local preference is a standard attribute used to influence outbound routing choices within the on-premises Autonomous System.
3
Evaluate the administrative overhead of the proposed routing mechanisms.
Using dynamic routing (BGP) on both paths propagates changes automatically, minimizing manual configuration compared to static routing.
This satisfies the constraint of minimizing administrative overhead.

Anahtar Kavram

BGP routing preference and path selection in hybrid AWS network designs using Transit Gateway
Bu soruyu puanla

Konular

Hybrid and Multi-Account Network Connectivity Design

Bu konudan daha fazla soru